使用GlobalSign DSS的iText 7 PDF签名

Question

我正在ASP.NET应用程序中使用iText7对PDF进行数字签名。我用的是vb，但我也能找到一个C#答案。我们使用GlobalSign DSS以使签名不作为未知(AATL)出现。

我从我们公司的SSL证书创建了一个pfx文件，我可以使用该文件对PDF文件进行签名，但我不明白如何使用从GlobalSign获得的东西来完成同样的事情。此服务要求发送一个十六进制编码的SHA256摘要，作为返回，我接收一个十六进制编码的SignatureValue。除此之外，我还接收到一个PEM编码的X509签名证书、中间证书（表示签名证书颁发者的PEM编码的X509证书）、signing_certificate的OCSP响应的Base64编码的DER表示、timestamp令牌的Base64编码的DER表示。它包括SignedData.CertificateSet中的TSA签名证书。

Dim outputFileStream As New FileStream(Server.MapPath(strDest), IO.FileMode.Create, IO.FileAccess.ReadWrite)
Dim signer As New PdfSigner(New PdfReader(Server.MapPath(strTemp)), outputFileStream, True)

signer.SetCertificationLevel(PdfSigner.CERTIFIED_FORM_FILLING_AND_ANNOTATIONS)

Dim appearance As PdfSignatureAppearance = signer.GetSignatureAppearance
Dim rect As New iText.Kernel.Geom.Rectangle(50, 425, 500, 200)
appearance.SetContact("Contact Name - Phone")
appearance.SetSignatureCreator("Company - New Program")
appearance.SetReason(vbCrLf + "eDoc Consent Agreement: " + CType(Session("eDocConsentDateTime"), Date).ToString + vbCrLf _
                     + "Terms and Conditions Agreement: " + objInstall.AgreementSigned.ToString + vbCrLf _
                     + "Identifier: " + Session("Ident"))
appearance.SetLocation(vbCrLf + strInstallationAddress)
appearance.SetReuseAppearance(False)
appearance.SetPageRect(rect)
appearance.SetPageNumber(2)     'Signature will appear on Page 2
appearance.SetRenderingMode(PdfSignatureAppearance.RenderingMode.DESCRIPTION)

signer.SetFieldName(signer.GetNewSigFieldName())

Dim cert As New X509Certificate(Server.MapPath("CompSSL.pfx"), "password")
Dim tsaUrl As String = CertificateUtil.GetTSAURL(DotNetUtilities.FromX509Certificate(cert))
tsaClient = New TSAClientBouncyCastle(tsaUrl)
Dim crlList As IList(Of ICrlClient) = New List(Of ICrlClient)()

Dim fsCertFile As New FileStream(Server.MapPath("CompSSL.pfx"), FileMode.Open, FileAccess.Read)
Dim pk12 As New Pkcs12Store(fsCertFile, "password")
fsCertFile.Dispose()

'then Iterate throught certificate entries to find the private key entry
Dim [alias] As String = Nothing
For Each tAlias As String In pk12.Aliases
  If pk12.IsKeyEntry(tAlias) Then
    [alias] = tAlias
    Exit For
  End If
Next
Dim pk = pk12.GetKey([alias]).Key

Dim myExternalSignature As IExternalSignature = New PrivateKeySignature(pk, DigestAlgorithms.SHA1)

signer.SignDetached(myExternalSignature, New Org.BouncyCastle.X509.X509Certificate() {pk12.GetCertificate([alias]).Certificate}, Nothing, Nothing, Nothing, 0, PdfSigner.CryptoStandard.CMS)

null

我试着遵循iTextsharp的例子，甚至这个例子（iTextsharp用带签名的哈希签名pdf），这正是我正在尝试做的，但它似乎没有给我完成它所需的信息。谢谢你的帮助。

编辑:
谢谢你的帮助，Dsandoval。我继续对未更改的文件进行散列，这就是我发送给GlobalSign的内容：

Dim s As New SHA256Managed
Dim fileBytes() As Byte = IO.File.ReadAllBytes(Server.MapPath(strSrc))
Dim hash() As Byte = s.ComputeHash(fileBytes)
Dim calculatedHash As String = ByteArrayToString(hash)

还有这个：

Private Function ByteArrayToString(ByVal arrInput() As Byte) As String
  Dim sb As New System.Text.StringBuilder(arrInput.Length * 2)
  For i As Integer = 0 To arrInput.Length - 1
    sb.Append(arrInput(i).ToString("X2"))
  Next
  Return sb.ToString().ToUpper
End Function

Using sw As New StreamWriter(File.Open(strFile2, FileMode.OpenOrCreate))
  sw.WriteLine(strTempCert2)
End Using
Dim fileStream2 = System.IO.File.OpenText(strFile2)
Dim pemReader2 = New Org.BouncyCastle.OpenSsl.PemReader(fileStream2)
Dim myCertificateChain() As Org.BouncyCastle.X509.X509Certificate = New Org.BouncyCastle.X509.X509Certificate() {pemReader.ReadObject, pemReader2.ReadObject}

Private Function StringToByteArray(s As String) As Byte()
  ' remove any spaces from, e.g. "A0 20 34 34"
  s = s.Replace(" "c, "")
  ' make sure we have an even number of digits
  If (s.Length And 1) = 1 Then
    Throw New FormatException("Odd string length when even string length is required.")
  End If

' calculate the length of the byte array and dim an array to that
  Dim nBytes = s.Length \ 2
  Dim a(nBytes - 1) As Byte

  ' pick out every two bytes and convert them from hex representation
  For i = 0 To nBytes - 1
    a(i) = Convert.ToByte(s.Substring(i * 2, 2), 16)
  Next

  Return a
End Function

signer.SignDetached(myExternalSignature, myCertificateChain, Nothing, Nothing, Nothing, 0, PdfSigner.CryptoStandard.CMS)

Answer 1

我使用C#实现。我对VB不太熟悉，但希望这能有所帮助。我所看到的大多数示例都是使用Java的，它们在如何实现这一点上存在一些差异，所以我必须围绕它们进行工作。我必须为这项工作实现的唯一东西是iExternalSignatural、IOcspClient和iSaclient。

>

发送给GlobalSign的摘要是应用于签名之前的文档内容，因此如果应用于签名，可以省略外观。我相信，在使用pdfsigner.signdetached应用签名之前，文档不会被修改。要计算摘要，需要使用SHA256算法对消息进行散列并对其进行hexencode。这是将发送给GS的摘要。

您需要将GlobalSign中的两个证书都放入以创建证书链。首先添加签名证书，然后添加可以从他们的'Certificate_Path'endpoint检索的证书。

我不确定如何转换为该类型，但在C#库中，IExternalSignature的Sign方法返回一个字节[]。使用我自己的接口实现，我只需将从GS接收到的SignatureValue转换为Byte[]。

对于时间戳，我们还实现了自己的ITsaClient，它调用GS来获取时间戳。摘要必须在GetTimeStampToken方法中计算并发送到GS。响应是一个hexencoded字符串，我们将其转换为byte[].

对于OCSP，我们还实现了自己的IOCSPClient。由于我们在获取标识时获得ocsp_response，所以这个客户机只需使用它，而不是再次调用GS。在仅将Base64字符串转换为Byte[]返回响应时，我在启用LTV时遇到了问题。BouncyCastle在阅读这种格式的回应时遇到了困难。我必须将其转换为下面的BouncyCastle对象，才能正常工作。

public byte[] GetEncoded( X509Certificate checkCert, X509Certificate issuerCert, string url )
{
    var decoded = Base64.Decode(_ocspResponse); //_ocspResponse is same one that we received when fecthing the identity
    var response = new OcspResp(decoded);
    var basicResponse = (BasicOcspResp)response.GetResponseObject();

    return basicResponse.GetEncoded();
}

让我知道，如果你需要任何更多的代码示例或任何其他问题。

public class ExternalSignature : IExternalSignature
{
    private readonly SigningIdentity _identity;
    private readonly GlobalSignClient _client;
    public ExternalSignature( GlobalSignClient client, SigningIdentity identity )
    {
        _client = client;
        _identity = identity;
    }

    public string GetEncryptionAlgorithm() => "RSA";

    public string GetHashAlgorithm() => DigestAlgorithms.SHA256;

    public byte[] Sign( byte[] message )
    {
        // Using the System.Security.Cryptography implementation of SHA256
        using (var sha = SHA256.Create())
        {
            // Hash the message, containing the PDF
            var bytes = sha.ComputeHash(message);
            // HexEconde the hashed message to send to GlobalSign   
            var digest = Helpers.ByteArrayToString(bytes);
            // Send the digest to GlobalSign
            var signature = _client.GetSignatureAsync(_identity.Id, digest).Result;
            // Return the returned signature as a byte[]
            return Helpers.StringToByteArray(signature);
        }
    }
}

var signature = new ExternalSignature(_client, signingIdentity);
...
...
//After creating the PDF signer, adding appearance, creating the OCSP and TSA clients.
signer.SignDetached(signature, certChain, null, ocsp, tsa, 0, PdfSigner.CryptoStandard.CMS);

我对OCSP和TSA的客户也做了同样的事情。